CVE-2026-62112 WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability

Editor SQL Injection in Amelia = 2.4.9 versions...

EUVD-2026-76208

Editor SQL Injection in Amelia = 2.4.9 versions...

CVE-2026-62112 WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability

Editor SQL Injection in Amelia = 2.4.9 versions...

CVE-2026-62112

CVE-2026-62112 affects the Amelia WordPress plugin in versions ≤ 2.4.9 , containing an Editor-level SQL Injection vulnerability discovered by Ananda Dhakal (Patchstack). The vulnerability requires high privileges (editor role) to exploit but carries a CVSS 3.1 score of 7.6 (HIGH) with high confid...

EUVD-2026-76211

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-62109 WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-62109 WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-62109

Editor SQL Injection vulnerability in the Sky Addons for Elementor WordPress plugin, affecting versions 3.8.4 and below . Discovered by Ananda Dhakal via Patchstack, the flaw resides in the editor functionality and allows a high-privilege authenticated user to inject SQL, resulting in high confid...

CVE-2026-81909 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...

SUSE CVE-2026-19843

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

PT-2026-90024

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

PT-2026-89913

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description A mass assignment issue exists in the editer objet action. Unauthenticated attackers can write arbitrary rows to any SQL table that does not have a champs editables allowlist by providing a controlled...

CVE-2026-62112: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Amelia = 2.4.9 versions...

PT-2026-90027

Editor SQL Injection in Amelia = 2.4.9 versions...

CVE-2026-62109: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

The vulnerability of the tree_count_words() function in the src/spellfile.c file of the Vim text editor allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the treecountwords function in the src/spellfile.c file of the Vim text editor is related to the operation of writing data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

GHSA-X7M8-JRM8-HPVX @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

PYSEC-2026-3883 plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

CVE-2026-78374: Insertion of Sensitive Information Into Sent Data

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...